build: harden as per zizmor

Author: berezovskyi

.github/workflows/main.yml

@@ -119,7 +119,7 @@ jobs:
       - name: Pack NuGet packages (snapshot)
         shell: pwsh
         run: |
-          dotnet pack -c Release -o ${{ env.NuGetDirectory }}
+          dotnet pack -c Release -o $env:NuGetDirectory
         if: |
           success() && github.ref == 'refs/heads/main'
           && matrix.version.target == 'net8.0' && matrix.os == 'windows-latest'
@@ -131,7 +131,7 @@ jobs:
           if ( $env:GITHUB_REF -match '^refs/tags/v(.*)$' ) {
             $VERSION=$matches[1]
             Write-Host $VERSION
-            dotnet pack -c Release -p:RELEASE_VERSION=$VERSION -o ${{ env.NuGetDirectory }}
+            dotnet pack -c Release -p:RELEASE_VERSION=$VERSION -o $env:NuGetDirectory
           } else {
             Write-Error "Failed to extract the version from env:GITHUB_REF"
             Exit 1
@@ -151,19 +151,23 @@ jobs:
           && matrix.version.target == 'net8.0' && matrix.os == 'windows-latest'
       - name: Publish NuGet packages (GH/always)
         shell: pwsh
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          foreach($file in (Get-ChildItem "${{ env.NuGetDirectory }}" -Recurse -Include *.nupkg)) {
-              dotnet nuget push $file --api-key ${{ secrets.GITHUB_TOKEN }} --skip-duplicate --no-symbols
+          foreach($file in (Get-ChildItem $env:NuGetDirectory -Recurse -Include *.nupkg)) {
+              dotnet nuget push $file --api-key $env:GITHUB_TOKEN --skip-duplicate --no-symbols
           }
         if: |
           success()
           && matrix.version.target == 'net8.0' && matrix.os == 'windows-latest'
           && (github.ref == 'refs/heads/main' || github.event_name == 'release' || inputs.release)
       - name: Publish NuGet packages (NuGet.org/release)
         shell: pwsh
+        env:
+          NUGET_APIKEY: ${{ secrets.NUGET_APIKEY }}
         run: |
-          foreach($file in (Get-ChildItem "${{ env.NuGetDirectory }}" -Recurse -Include *.nupkg)) {
-              dotnet nuget push $file --api-key "${{ secrets.NUGET_APIKEY }}" --source https://api.nuget.org/v3/index.json --skip-duplicate --no-symbols
+          foreach($file in (Get-ChildItem $env:NuGetDirectory -Recurse -Include *.nupkg)) {
+              dotnet nuget push $file --api-key $env:NUGET_APIKEY --source https://api.nuget.org/v3/index.json --skip-duplicate --no-symbols
           }
         if: |
           success()

.github/workflows/scorecard.yml

@@ -15,7 +15,8 @@ on:
     branches: [ "main" ]
 
 # Declare default permissions as read only.
-permissions: read-all
+permissions:
+  contents: read
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}

.github/workflows/sonarcloud.yml

@@ -6,7 +6,8 @@ on:
   pull_request:
     types: [opened, synchronize, reopened]
 
-permissions: read-all
+permissions:
+  contents: read
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}